It was only around the time of the Elcomsoft report that we (at AgileBits) became aware of the importance of authenticated encryption. The theorems had been aro

It was only around the time of the Elcomsoft report that we (at AgileBits) became aware of the importance of authenticated encryption. The theorems had been around for more than a decade, but news didn't filter down to application developers (or if it did it went in one ear and out the other). This is a big problem in general. Part of the problem stems from the fact that application developers are also (correctly) reluctant to use things that aren't in standard libraries and that don't have standards behind them. Even today, Apple's CommonCrypto offers no authenticated encryption modes, and only documents CBC and ECB. (CTR is available, but not documented as such.) And back to the current issue, we would have moved to scrypt from PBKDF2 already if it were readily available in well-reviewed implementations. But also this stuff is hard (fun, but hard). And not every development team is going to have the expertise on board to really follow this stuff. They are just going to go with what's in the most easily accessible libraries, and if we are lucky, they won't use their encryption keys as IVs for CBC. Lots of people are talking about how to improve the situation. I'm "cautiously optimistic".